{"answers":{"affected":"","exploited":"There is no known exploitation of openSUSE-SU-2026:20889-1 in the wild and no public exploit code.","fix":"No fix has been published for openSUSE-SU-2026:20889-1 yet. Limit exposure of the affected software until one is available.","what":"openSUSE-SU-2026:20889-1 is a memory corruption vulnerability, published on 2 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for openSUSE-SU-2026:20889-1 and fix it if it is affected.\n\nWhat it is: openSUSE-SU-2026:20889-1 is a memory corruption vulnerability, published on 2 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of openSUSE-SU-2026:20889-1 in the wild and no public exploit code.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/openSUSE-SU-2026-20889-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2026-20889-1/index.md)","id":"openSUSE-SU-2026:20889-1","markdown":"https://insights.sbomify.com/openSUSE-SU-2026-20889-1/index.md","name":"openSUSE-SU-2026:20889-1","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Tor anonymity network","requires_auth":"none","summary":"Attackers can cause crashes or potentially execute code via memory corruption flaws in Tor's compression and consensus parsing.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"This update for tor fixes the following issues:\n\nChanges in tor:\n\n- Update to 0.4.9.9\n  * Major bugfixes (compression, security):\n    - Fix a compression bomb bypass where an attacker could concatenate\n      many gzip or zlib sub-streams, each just under the per-stream\n      detection threshold, to avoid the compression bomb check entirely.\n      TROVE-2026-022. Fixes bug 41275; bugfix on 0.3.1.1-alpha.\n    - Fix an infinite loop when decompressing a truncated zlib/gzip\n      stream with done=1. A truncated stream never reaches Z_STREAM_END,\n      causing zlib to return Z_BUF_ERROR with no input remaining, which\n      buf_add_compress() mistook for a full output buffer and retried\n      forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the\n      caller can abort cleanly. TROVE-2026-021. Fixes bug 41274; bugfix\n      on 0.2.6.1-alpha.\n  * Major bugfixes (conflux, security):\n    - Fix a NULL write after free when sending a CONFLUX_SWITCH cell\n      fails. The return value of relay_send_command_from_edge() was\n      ignored, so a send failure (which calls circuit_mark_for_close()\n      and removes the leg via cfx_del_leg()) would go undetected,\n      causing the caller to write to the now-freed current leg and\n      resulting in a crash. TROVE-2026-017. Fixes bug 41263; bugfix\n      on 0.4.8.1-alpha.\n  * Major bugfixes (security, TROVE-2026-019):\n    - Avoid out-of-bounds read/write when parsing a consensus or\n      detached signature with unexpected signature digest type. Impact\n      is minor for most Tor roles, but potentially major for directory\n      authorities. Fixes bug 41267; bugfix on 0.2.8.2-alpha.\n  * Major bugfixes (client stability, TROVE-2026-013, TROVE-2026-015):\n    - Protect against a client-side assert that can happen if a\n      malicious onion service gets the client to load its carefully\n      crafted onion descriptor. Fixes bugs 41259 and 41261; bugfix\n      on 0.3.1.1-alpha.\n  * Major bugfixes (code safety):\n    - Avoid a dangerous situation in router_find_exact_exit_enclave()\n      where we could have reached an assert if bridges or relays claim\n      an IP address of 0.0.0.0. Fixes bug 41276; bugfix on 0.4.5.1-alpha.\n  * Major bugfixes (conflux, shutdown):\n    - Fix a use-after-free in the shutdown path when freeing conflux\n      circuits. cfx_add_leg() shares stream list pointers across legs\n      without NULLing the old leg, so circuit_free_all() would free the\n      lists via one leg and then access freed memory via another. TROVE-\n      2026-016. Fixes bug 41262; bugfix on 0.4.8.1-alpha.\n  * Major bugfixes (DNSPort, TROVE-2026-018):\n    - Fix a client-side crash that would happen if we decide to stop\n      reading on a RESOLVE request that came from the DNSPort or\n      controller. This crash could happen naturally under heavy load and\n      with poor luck, but since 0.4.7.2-alpha it could be induced by the\n      exit relay via a flow control request. Fixes bug 41265; bugfix\n      on 0.2.0.1-alpha.\n  * Major bugfixes (memory safety, TROVE-2026-014):\n    - Avoid a heap-use-after-free mistake that can happen in the conflux\n      subsystem, and which can be induced at either the client or the\n      exit relay. Fixes bug 41260; bugfix on 0.4.8.1-alpha.\n  * Major bugfixes (onion services, TROVE-2026-020):\n    - Avoid a possible divide by zero crash on onion services that have\n      the proof-of-work (PoW) defense enabled. This bug could be hit by\n      extreme bad luck or maybe by the help of an attacker crafting just\n      the right circumstances. Fixes bug 41270; bugfix on 0.4.8.1-alpha.","ecosystems":[],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":null,"headline":"Security update for tor","id":"openSUSE-SU-2026:20889-1","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":null,"packages":[],"products":null,"published":"2026-06-02","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can cause crashes or potentially execute code via memory corruption flaws in Tor's compression and consensus parsing.","url":"https://insights.sbomify.com/openSUSE-SU-2026-20889-1/"}